Debugging WireGuard VPN on GCP: NAT IP Mismatch and Linux rp_filter Packet Drops

Short summary

A debugging narrative about setting up a WireGuard VPN hub on a GCP e2-micro instance to connect a phone and laptop. The author hit two key issues: using the internal VM IP instead of the public NAT IP in client configs, and Linux kernel Reverse Path Filtering silently dropping packets on the laptop. Fixing rp_filter from strict to loose mode and correcting the routing table resolved the connectivity problem after four hours.

• •GCP VMs use 1:1 NAT; client configs must reference the external public IP, not the internal one
• •Linux rp_filter in strict mode silently drops VPN packets when reply routing is asymmetric
• •Setting rp_filter to loose mode (2) and fixing routes resolved the issue

Generated with AI, which can make mistakes.